Fix file upload

upload.php was reading from sign-in form not upload form